CVE-2023-36932

What it actually does

CVE-2023-36932 is an authenticated SQL injection issue in the Progress MOVEit Transfer web application. A low-privileged authenticated user can submit crafted input to vulnerable application endpoints that is incorporated into backend SQL queries without sufficient validation or parameterization. Successful exploitation can allow unauthorized reading or modification of MOVEit Transfer database contents, including file-transfer metadata, user/account data, configuration data, and other sensitive records accessible to the application database user. The CVSS vector indicates network exploitation, low attack complexity, no user interaction, and high confidentiality and integrity impact, but no direct availability impact.

Why it matters to the business

A compromised MOVEit Transfer instance can expose sensitive files, transfer records, user information, and operational configuration stored in the application database. Because MOVEit Transfer is commonly used for business-critical managed file transfer workflows, exploitation can lead to data breach notifications, regulatory exposure, partner trust impact, disruption to secure file exchange processes, and costly incident response. The vulnerability is not currently listed in CISA KEV and is not marked as ransomware-associated, but the high EPSS score indicates a meaningful likelihood of exploitation attempts against exposed systems. The issue is older, so any remaining unpatched deployment should be treated as overdue and higher risk.

How an attack unfolds

An attacker first obtains valid credentials for a MOVEit Transfer account, such as through phishing, credential stuffing, password reuse, exposed service accounts, or abuse of a low-privileged user. After authenticating to the web application, the attacker identifies vulnerable request parameters in MOVEit Transfer endpoints and submits SQL metacharacters or conditional SQL payloads. If the application passes the crafted input into a database query unsafely, the attacker can infer database behavior through responses, errors, timing, or returned data. The attacker then expands from proof-of-concept payloads to targeted queries that disclose database records or alter records. Depending on database permissions and application design, this may expose transfer metadata, user attributes, session-related data, application settings, or other sensitive data stored in the MOVEit database. Because exploitation requires authentication, evidence may appear as suspicious activity from valid user accounts rather than unauthenticated scanning.

How to fix it

Upgrade MOVEit Transfer to a fixed version or later. Fixed Progress MOVEit Transfer versions are 2020.1.11 / 12.1.11, 2021.0.9 / 13.0.9, 2021.1.7 / 13.1.7, 2022.0.7 / 14.0.7, 2022.1.8 / 14.1.8, and 2023.0.4 / 15.0.4. If package-based scanning reports Debian 11 remediation metadata, ensure affected Linux packages are updated to the vendor-provided fixed package level, including 5.10.197-1 where applicable, but prioritize confirming the MOVEit Transfer application version because this vulnerability is in the MOVEit Transfer web application. If immediate upgrade is not possible, restrict access to the MOVEit Transfer web interface to trusted networks or VPNs, enforce MFA, disable or lock dormant accounts, rotate credentials for privileged and service accounts, review least-privilege database permissions, and increase logging around authenticated web requests. Treat mitigations as temporary; patching is the required fix.

How to confirm the fix worked

Confirm the installed MOVEit Transfer version is equal to or newer than the fixed version for the deployed major release: 12.1.11, 13.0.9, 13.1.7, 14.0.7, 14.1.8, or 15.0.4. Validate through the product administrative interface, installed application metadata, vendor patch inventory, and vulnerability scanner results. For Debian 11 package findings, confirm relevant packages report the fixed version 5.10.197-1 or later where that package advisory applies, and reconcile any mismatch with Progress MOVEit Transfer application versioning. Run authenticated vulnerability scans or vendor-supported health checks after patching. Review web application access logs to ensure no continued SQL error responses or blocked SQL injection signatures are observed after remediation. If a web application firewall is used, confirm rules are in prevention mode for SQL injection patterns, but do not rely on WAF blocking as evidence that the application is patched.

Typical attack path

1. Identify an internet-accessible or internally reachable MOVEit Transfer web application running a vulnerable version.
2. Acquire valid MOVEit Transfer credentials through phishing, credential reuse, prior compromise, insider access, or abuse of a low-privileged account.
3. Authenticate to the MOVEit Transfer web interface or API.
4. Send crafted requests containing SQL injection payloads to vulnerable application endpoints.
5. Use error messages, timing differences, or returned records to confirm SQL injection behavior.
6. Enumerate database structure or target known MOVEit Transfer tables and application records.
7. Extract sensitive database content or modify records to support further access, concealment, or data theft.
8. Use obtained information to access files, user data, partner workflows, or additional systems where possible.

How to detect it

To determine whether exploitation already occurred, review MOVEit Transfer web access logs, application logs, authentication logs, database audit logs, WAF logs, reverse proxy logs, and EDR telemetry for suspicious authenticated activity. Focus on valid user sessions that issued unusual requests containing SQL metacharacters, encoded SQL keywords, stacked-query separators, comment markers, or time-based SQL injection functions. Correlate these requests with HTTP 500 errors, database exception messages, unusually long response times, large response sizes, abnormal download or export behavior, account profile changes, unexpected administrative actions, or database write activity inconsistent with normal user workflows. Examine authentication history for logins from new geographies, anonymous proxies, hosting providers, impossible travel, or failed-login bursts followed by success. In database logs, look for application-account queries containing UNION, information_schema, system catalog access, conditional expressions, or unexpected UPDATE/DELETE statements. Because this flaw requires authentication, prioritize anomalous behavior by legitimate accounts rather than only unauthenticated scanning. If exploitation is suspected, preserve logs and forensic images, rotate credentials, and review whether database contents or file-transfer records were accessed or modified.

• UNION SELECT
• UNION%20SELECT
• UNION+SELECT
• information_schema
• INFORMATION_SCHEMA
• sys.objects
• sqlite_master
• pg_catalog
• WAITFOR DELAY
• SLEEP(
• BENCHMARK(
• DBMS_PIPE.RECEIVE_MESSAGE
• OR 1=1
• OR%201%3D1
• ' OR '1'='1
• " OR "1"="1
• --
• /*
• */
• ;SELECT
• ;UPDATE
• ;DELETE
• xp_cmdshell
• SQL syntax
• SQLException
• ODBC SQL
• database error
• invalid column name
• unclosed quotation mark
• syntax error at or near
• You have an error in your SQL syntax
• Microsoft OLE DB Provider for SQL Server
• System.Data.SqlClient.SqlException
• C:\MOVEitTransfer\Logs
• C:\MOVEitDMZ\Logs
• /var/log/moveit
• /opt/moveit/logs

What your security team should do

• Prioritize patching all MOVEit Transfer deployments to the applicable fixed release because the vulnerability has high confidentiality and integrity impact and a high EPSS probability despite not being listed in KEV.
• Inventory all MOVEit Transfer instances, including internet-facing, partner-facing, disaster recovery, test, and legacy deployments.
• Restrict MOVEit Transfer administrative and user access to trusted networks where operationally feasible, and enforce MFA for all accounts.
• Review all MOVEit Transfer accounts for dormant users, weak authentication patterns, excessive privileges, and unexpected recent activity.
• Search historical logs for authenticated requests containing SQL injection markers, database error responses, unusual query timing, or abnormal data access patterns.
• Rotate credentials for privileged MOVEit Transfer accounts, service accounts, and database accounts if exploitation is suspected.
• Review database audit logs for unauthorized SELECT, UPDATE, INSERT, DELETE, or schema-enumeration activity executed by the MOVEit application account.
• Preserve web, application, database, and authentication logs before patching or rebuilding systems if compromise is suspected.
• Deploy or tune WAF/SIEM detections for SQL injection attempts against MOVEit Transfer endpoints as a compensating control.
• Coordinate with legal, privacy, and business owners if logs indicate possible disclosure or modification of regulated or partner data.